Resolved! Remediation Target Rules - how to delete?
What role is needed to be able to delete Remediation Target Rules? I have sn_vul.admin role but I don't get the option to delete them. Is there another role specific to these rules?
Forum Posts
Resolved! Tutorial: Implementation of Vulnerability Response and Security Incident Response
Update: The video and slides are now available on this page. Hello all, I am pleased to now announce that the follow-up to the February 26 tutorial, will be published on March 27 at 10am PT. This second tutorial will pick up the step-by-step guide ...
Resolved! Connecting to RestAPI from Excel or PowerBI and getting all fields in security incident to display
Hello all, I have a requirement to bring in all ServiceNow Security Incident Records and any available fields that could be selected into Microsoft Power BI. This is really no different that Excel Power Query but I'm running into issues and gettin...
Resolved! Automatic Assignment of Support Groups based on Business Service associate with CI
Hello Folks, My very first post on the platform, a fairly new person to ServiceNow; especially when it is about something that is not out-the-box. I have a request where the customer wants to have the following done when a vulnerable item is identi...
Resolved! Create Vulnerable Items with SAM NVD
Hello everyone! I'm implementing Vulnerability Response for a client and I did the upgrade to Madrid yesterday. I'm trying to update my VIs through SAM NVD. I did import all the feeds on the NVD libraries. Nothing is created.... all the business rule...
Are there security concerns with allowing xlsm files as attachments?
I'm trying to figure out if I should allow xlsm files (Excel Macro Enabled Workbook) into our instance. I want to say "no" just because those files can use VB and I don't know what code people write. Does anyone know if there are security concerns w...
Resolved! QRadar Integration
Hi All,I need to connet QRadar SIEM to ServiceNow using the Mid-Server.Which ports I need to open between QRadar and Mid-Server ?RegardsVincenzo
Resolved! PAN NGFW EDL Access Issue - URL Access Error
Hello, The user profile we created in service-now authenticates if I enter credentials by hitting the EDL URL from my browser. When I test the same URL from the Palo Alto Firewall(Panorama/v8.1.16) itself, I get a URL access error. I followed the in...
Resolved! Why use Duplication Rules instead of Event Management for Security Operations
Hello all, So I know event management is the preferred means of dealing with INC in ServiceNow and that when one is using the default ServiceNow incident creation abilities, one can use the Duplication Rules. In our situation, we have so many thin...
Resolved! SIR/VR Training Examples
Hi All, I'm being asked to step in and assist in create/perform some SecOps ServiceNow ITIL user level training in a few weeks. Looking for examples of Sec Analyst/Manager level ServiceNow training anyone has given or just some pointers on key area...
Resolved! Automatic calculation of Priority in Security Incident
In our Security Incident module, priority is calculated when the record is first created. It is calculated again if the "Calculate Severity" UI Action is selected (if updates were made that would cause it to change). Any ideas on how I could make th...
Resolved! please tell me the real time scenarios related to Acls
with examples
Resolved! Mapping Fields in an SIR
Hello, I'm currently looking to map domains being sent from Splunk to our SNOW environment so that they'll also show up in the observable table. While there are fields for hash and IP, I'm not seeing any that would line up with domain other than othe...
Resolved! In vulnerability response how to implementation scanne using the third party scanner?
Hi All, I am implementing Vulnerability response module. As part of that we have to implement "Scanner" under the Vulnerability scanning. I have gone through the Service-now doc but unable to implement. Can anybody suggest implementation steps, so ...
Resolved! Getting acceptable value out of SecOps Incident Observables with automatic creation
Hello all, I have recently had an instance of Security Operations installed in our environment that we are struggling to get value out of. The current situation has us getting an incident created, then once its created - the analyst has to take th...